EUVD-2025-209320Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 8.4 reflects high confidentiality/integrity impact on line card root access, but exploitation requires privileged local authentication (PR:H). Broad version impact across MPC/LC/FPC hardware lines increases organizational exposure for large Juniper deployments. Moderate observed exploitation activity suggests targeted use against authenticated insiders or post-compromise scenarios. Priority depends on internal access controls and deployment scale. |
| Exploit ScenarioDerived | Authenticated privileged user executes unauthenticated command on line card via local interface, bypassing authentication checks to gain root access. No public exploit code identified at time of analysis. Attack requires existing elevated privileges on chassis to reach vulnerable command processing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-based line cards running Junos OS Evolved. Missing authentication in critical command processing functions enables authenticated administrators with elevated privileges to bypass access controls and execute commands as root on affected hardware modules including MPC7-11, LC2101/2103, LC480/4800/9600, MX304 built-in FPC, MX-SPC3, SRX5K-SPC3, EX9200-40XS, and PTX-series line cards. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patches: upgrade to Junos OS 22.4R3-S8, 23.2R2-S6, 23.4R2-S6, 24.2R2-S3, 24.4R2, or 25.2R2 depending on active release train. Prioritize systems with affected Linux-based line cards listed in affected products. Implement least-privilege access controls to limit high-privilege local account usage until patching completes. Monitor administrative session logs for anomalous command execution on forwarding plane components. Apply role-based access restrictions to reduce attack surface from privileged accounts. Official advisory: https://supportportal.juniper.net/JSA107863 and https://kb.juniper.net/JSA107863. Security research context: https://github.com/orangecertcc/security-research/security/advisories/GHSA-fwhc-gh5m-v8fq
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-306 authentication bypass in command processing subsystem permits privileged local users to interact with Linux-based forwarding plane cards without proper credential verification. Attack requires local access vector with high privileges (CVSS PR:H), exploiting missing authentication controls in inter-process communication channels between control plane (Junos OS) and data plane components (Junos OS Evolved on line cards).
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:N/R:A/V:C/RE:M/U:Amber
Primary rating from Vendor (juniper) · only source for this CVE.
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Missing Authentication for Critical Function vulnerability in command processing of Juniper Networks Junos OS allows a privileged local attacker to gain access to line cards running Junos OS Evolved
as root.
This issue affects systems running Junos OS using Linux-based line cards. Affected line cards include:
- MPC7, MPC8, MPC9, MPC10, MPC11
- LC2101, LC2103
- LC480, LC4800, LC9600
- MX304 (built-in FPC)
- MX-SPC3
- SRX5K-SPC3
- EX9200-40XS
- FPC3-PTX-U2, FPC3-PTX-U3
- FPC3-SFF-PTX
- LC1101, LC1102, LC1104, LC1105
This issue affects Junos OS:
- all versions before 22.4R3-S8,
- from 23.2 before 23.2R2-S6,
- from 23.4 before 23.4R2-S6,
- from 24.2 before 24.2R2-S3,
- from 24.4 before 24.4R2,
- from 25.2 before 25.2R2.
Executive ViewAI
CVE-2025-30650 is a privilege escalation vulnerability in Juniper Junos OS Evolved affecting line card hardware that allows authenticated high-privileged administrators to gain unauthorized root access on Linux-based modules. This vulnerability impacts core routing infrastructure (MX, PTX, SRX5K, EX9200 series) and could enable insider threats or compromised admin accounts to seize control of network appliances, potentially affecting network availability and data integrity.
Apply vendor patch. Interim: restrict administrative access to affected line card modules to only essential personnel; enforce multi-factor authentication for administrative sessions; implement command logging and monitoring for privilege escalation attempts; consider isolating non-critical affected hardware until patching is complete.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB